CVE-2025-36566: OS Command Injection
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36566?
CVE-2025-36566 has been categorized as a high severity vulnerability due to the potential for unauthorized access and exploitation.
How do I fix CVE-2025-36566?
To fix CVE-2025-36566, users should upgrade their Dell PowerProtect Data Domain systems to the latest patched version as recommended by Dell.
What versions of Dell PowerProtect Data Domain are affected by CVE-2025-36566?
CVE-2025-36566 affects Dell PowerProtect Data Domain systems running DD OS versions from 7.7.1.0 through 8.1.0.10 and includes specific LTS release versions.
What are the consequences of not addressing CVE-2025-36566?
Failing to address CVE-2025-36566 may lead to data breaches and exploitation of the affected systems.
Is authentication required to exploit CVE-2025-36566?
CVE-2025-36566 can be exploited without authentication, increasing the risk associated with this vulnerability.